Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-27857
Publication date:
22/03/2023
<br /> In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field<br /> <br /> <br /> <br /> in Rockwell Automation&amp;#39;s ThinManager ThinServer.  An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation.<br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
09/01/2024

CVE-2023-27855
Publication date:
22/03/2023
<br /> In affected versions, a path traversal exists when processing a message in Rockwell Automation&amp;#39;s ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution. <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-27856
Publication date:
22/03/2023
<br /> <br /> <br /> In affected versions, path traversal exists when processing a message of type 8<br /> <br /> in Rockwell Automation&amp;#39;s ThinManager ThinServer. <br /> <br /> An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-28725
Publication date:
22/03/2023
General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March 2023. This is fixed in 20221118.48 and 20230120.44.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2025

CVE-2022-43512
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2022-41696
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2022-45468
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2022-45121
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2022-46286
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2022-46300
Publication date:
21/03/2023
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/01/2025

CVE-2023-24709
Publication date:
21/03/2023
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
28/02/2025

CVE-2023-26497
Publication date:
21/03/2023
An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5125. Memory corruption can occur when processing Session Description Negotiation for Video Configuration Attribute.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2025
Subscribe to Vulnerabilities